Once they have a list of IPs known (or believed) to be torrenting, they can then try to detect PeerGuardian by scanning those computers by connecting from other computers with IPs both on and off the blocklists. The ones that only accept connections from IPs not on the lists get prioritized as hardcore murderous raping Satan-worshipping butt-pirate pedophile terrorist athiests.